I Thought USPS Was Scamming Me — Here’s What I Learned About Email Security (And Modern Paranoia) | by Jennifer Wei

It started with what seemed like a perfectly normal email.

From: auto-reply@usps.com
Subject: USPS® Expected Delivery on Thursday, July 24, 2025 arriving by 6:00pm

The email looked legitimate. Official USPS branding, proper formatting, even a tracking number. But there was one problem: I’d never lived in Utah, and I hadn’t ordered anything from the “STATE OF UTAH TAX COMMISSION.”

Welcome to 2025, where a simple delivery notification can trigger a full-blown identity crisis.

My first instinct? This had to be a scam. I mean, why would I be getting mail from Utah’s tax commission? I’m a Canadian resident who hasn’t earned US income in years. The only connection I had to Utah was helping a friend with mail forwarding to maintain a US bank account.

But here’s the thing that made me click the link (yes, I clicked it — more on that later): the sender address looked completely legitimate. auto-reply@usps.com isn’t some sketchy domain like usps-tracking-update.net. It was the real deal.

Or so I thought.

Naturally, I panicked. I’d heard about email spoofing but never really understood how easy it was. Turns out, anyone can put president@whitehouse.gov in their “From” field and your email client will just… display it. No verification required.

So I did what any reasonable person would do in 2025: I became a part-time detective.

Step 1: Contact the real Utah Tax Commission
I sent them a carefully worded email explaining my confusion. Their response was swift and clear: “I am unable to locate your account by name. There is no account that comes up with the address provided.”

Step 2: Panic about malware
Because clicking suspicious links is apparently what I do now, I immediately installed Malwarebytes and ran a full system scan. (It found nothing but helpfully informed me my “protection was poor” — classic upsell attempt.)

Step 3: Change all my passwords
Because when in doubt, change everything.

Step 4: Investigate the tracking number
Here’s where things got weird. I copy-pasted the tracking number directly into USPS’s website (no more clicking mysterious links for me). The result? A completely legitimate delivery to that Utah address, confirmed delivered at 1:00 PM on July 24th.

Wait. What?

If this was a scam, it was incredibly sophisticated. The tracking number was real, the delivery was real, and the timing matched perfectly. But then my friend mentioned something casually: “I did receive mail about my car registration, so maybe they mixed up our names.”

Suddenly, the pieces started falling into place.

That’s when I decided to dig deeper into the email headers — you know, because apparently I’m a cybersecurity expert now. What I found changed everything:

dkim=pass header.i=@usps.com
spf=pass (google.com: domain of auto-reply@usps.com designates 56.0.84.91 as permitted sender)
dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=usps.com

For those who don’t speak email authentication (which, until yesterday, included me), this is the digital equivalent of a notarized signature. DKIM, SPF, and DMARC are cryptographic proofs that the email actually came from USPS servers. You literally cannot fake these if the receiving server checks them properly.

The email was 100% legitimate.

Here’s what actually happened: When I set up mail forwarding for my friend, USPS associated my email address with that Utah address. When legitimate mail arrived for my friend (probably tax-related documents for their car), USPS dutifully sent me a delivery notification because that’s exactly what their system is supposed to do.

I had successfully investigated myself for mail fraud.

But here’s the thing that really gets me: my paranoia was completely justified.

Email spoofing IS ridiculously easy. Scams ARE getting more sophisticated. The fact that I spent an entire day learning about DKIM signatures and DMARC policies just to verify a delivery notification isn’t paranoia — it’s the unfortunate reality of digital life in 2025.

We’ve reached a point where healthy skepticism requires a computer science degree. I had to:

Understand email authentication protocols
Contact government agencies for verification
Run malware scans

Analyze server logs
Cross-reference tracking information across multiple systems

All to confirm that yes, my friend got their car registration renewal.

The really exhausting part isn’t the technical complexity — it’s the constant vigilance. Every email, every text, every phone call requires a split-second threat assessment. Is this legitimate? Could this be spoofed? Should I click this link? What if I’m being too paranoid and miss something important?

We’re all walking around with this low-level anxiety about digital communication that didn’t exist 20 years ago. Remember when the biggest email worry was Nigerian prince scams that were obvious from a mile away?

Now we’re dealing with pixel-perfect reproductions of legitimate services, real tracking numbers, and scammers who know enough about your life to make their pitches convincing.

Email authentication is real and works — but you need to know how to check it
Trust but verify — my instinct to question the email was right, even though it was legitimate
The tools exist to protect us — DKIM, SPF, and DMARC are powerful when properly implemented

We shouldn’t need to be experts — the fact that email security requires this much technical knowledge is a systemic failure

In trying to protect myself from a sophisticated scam, I accidentally gave myself a masterclass in email security. I learned more about digital authentication in one afternoon than in years of casual internet use.

But here’s the real question: Why should any of us need to become part-time cybersecurity analysts just to check our mail?

The answer is both simple and depressing: because the systems we depend on were built for a more trusting time, and we’re all paying the cognitive price for their fundamental flaws.

At least I have a great story about the time I thought USPS was trying to scam me. And hey, if you ever need someone to explain DMARC policies at a party, I’m your person.

Source link